# @hono/node-server (npm) vulnerabilities

6 known vulnerabilities (2 high, 4 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Weekly downloads: 94M
- Dependents: 90.5K
- Registry: https://www.npmjs.com/package/@hono/node-server

## Advisories (6)

### [CVE-2026-118663](https://cve.now/CVE-2026-118663): @hono/node-server: \`serveStatic\` decodes the request path a second time, leading to bypass of middleware on static paths

- Severity: Medium 5.3
- Published: Oct 28, 2026
- Affected: from 1.19.10, fixed in 2.1.3.

### [CVE-2026-73565](https://cve.now/CVE-2026-73565): @hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake

- Severity: Medium 5.3
- Published: Aug 13, 2026
- Affected: from 2.0.0, fixed in 2.0.10.

### [CVE-2026-39406](https://cve.now/CVE-2026-39406): @hono/node-server has a middleware bypass via repeated slashes in serveStatic

- Severity: Medium 5.3
- Published: Apr 8, 2026
- Affected: fixed in 1.19.13.

### [CVE-2026-29087](https://cve.now/CVE-2026-29087): @hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware

- Severity: High 7.5
- Published: Mar 6, 2026
- Affected: fixed in 1.19.10.

### [CVE-2024-32652](https://cve.now/CVE-2024-32652): @hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsed

- Severity: High 7.5
- Published: Apr 19, 2024
- Affected: from 1.3.0, fixed in 1.10.1.

### [CVE-2024-23340](https://cve.now/CVE-2024-23340): @hono/node-server can't handle "double dots" in URL

- Severity: Medium 5.3
- Published: Jan 22, 2024
- Affected: from 1.3.0, fixed in 1.4.1.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/npm/@hono/node-server
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.